system and method of user authentication.

Abstract

The invention relates to a user authentication system comprising at least one application (10) installed on a mobile device (1) and comprising: a biometric data acquisition module (10B), a user information (UR) management module (10C) comprising at least the biometric data, said module being configured to store and record said information in a secure database, and an information transfer module (10D) configured to exchange information between the application (10) and at least one server, the biometric data acquired and recorded by the application (10) comprising a facial photograph of the user and a photograph of their identity document, the information being configured to be confirmed by a third-party server (3), so as to create a user account associated with said user's information.The secure database is installed on an authentication server (5) separate from the third-party server (3). Figure to be published for the abstract: Figure 3,

Description

Title of the invention: User authentication system and method. Technical field.

[0001] The present invention relates to a user authentication system, in particular using a mobile device application. The invention further relates to a method of user authentication, as well as various uses of said method.

[0002] The invention relates to the technical field of security, in particular computer security and user identity verification for the application. Prior art.

[0003] Currently, user security and authentication are growing concerns in the field of information technology. Various authentication methods have been proposed to secure access to systems and data, including passwords, smart cards, biometric devices, and / or other forms of unique identifiers. More complex systems have also been developed, but these only allow for partial verification of the user's identity. In fact, there is no way to be certain that a user is who they claim to be.

[0004] Furthermore, in recent years, most companies have implemented their own applications with application-specific authentication systems to allow users to access given goods and services. However, this requires users to use a large number of different applications, and the application-specific authentication system also complicates their use.

[0005] Patent document WO 2021 / 041566 Al discloses an authentication method and a system associated with said method, the system using a PAM (Pluggable Authentication Module) and a mobile application. This method allows a user's biometric data to be recorded in the application and a user to be requested to log in to a computer. The PAM performs the exchanges between the computer and the server, encoding and transmitting the data from one to the other. However, this system is complex and does not allow for verification of the information provided by the user.

[0006] Published patent document US 2014 / 0359299 Al discloses an authentication method using a phone application that requires the creation of a user account on the application. When using a service, a QR code is The method is offered to the user, who will use the application to decode it. However, no detailed explanation is provided to explain how the disclosed method works. The information provided by the user is also not verified.

[0007] The invention aims to overcome at least one of the drawbacks of the aforementioned prior art. More specifically, the invention aims to improve user authentication. It also simplifies existing authentication systems while maintaining a high level of security.

[0008] The invention also aims to improve security when opening a computer session.

[0009] The invention also aims to facilitate the determination of the user's age, without the user needing to provide personal information.

[0010] The authentication method makes it possible to verify the identity of users to access certain goods requiring identity verification, such as for the purchase of tickets or the receipt of a package for example.

[0011] The invention also aims to facilitate and secure banking transactions and means of payment, by ensuring that the user is properly authorized to make the request. Presentation of the invention.

[0012] The solution proposed by the invention is a user authentication system comprising at least one application configured to be installed on a mobile device, said application comprising: a transmission module configured to exchange data from at least one imaging device of the mobile device, a biometric data acquisition module configured to acquire and receive said data from the transmission module, a user-provided information management module comprising at least biometric data, said module being configured to store and record said information in at least one secure database, and an information transfer module configured to exchange information between the application and at least one server, the biometric data acquired and recorded by the application comprising a facial photograph of the user and a photograph of their identity document,The information is configured to be confirmed by at least one server, said server being a third-party server, in order to create a user account associated with said user's information, the secure database being installed on an authentication server separate from the third-party server.

[0013] By "authentication system" is meant a system for verifying that the user is indeed who he or she claims to be. This system operates in two stages: first, it verifies the validity of the identity document provided by the user when creating the account with the relevant authorities, and then in a The second step involves verifying that the user whose identity has been verified is the one using the application to access goods or services. "User" refers to the person using the application and requesting the creation of a verified user account. This user may be associated, within the mobile device's application, with other individuals or users who have other accounts, such as children, individuals under guardianship, or a spouse, for example. Access to certain data may also be partial, allowing, for instance, one user to grant authorization to another user (to receive a package, among other things).

[0014] Preferably, a user account is associated with a set of information including, in particular, the user's biometric data, each account corresponding to a single user. This information may include personal information such as the user's surname, first name, or date of birth, for example, and include biometric data such as a photo of the user or fingerprints, for example.

[0015] The imaging device(s) of the mobile device that can retrieve biometric data may be a camera, a photo camera or any reader integrated into the mobile device, such as, for example, a fingerprint reader.

[0016] Advantageously, the user's information and biometric data associated with his / her account are kept in secure databases provided in the application and / or in the authentication server of the application manager.

[0017] The main objective of the invention is to verify the identity of the account holder, ensuring that the person creating the account is indeed who they claim to be. The creation of this account will allow organizations, companies, associations, and more generally, third parties to verify the user's identity in a simple and secure manner. The security provided by the application is enhanced compared to existing systems, notably through the use of multiple authentication methods.

[0018] Other advantageous features of the system of the invention are listed below. Each of these features may be considered alone or in combination with the notable features defined above. Each of these features contributes, where applicable, to the resolution of specific technical problems defined further in the description and in which the notable features defined above do not necessarily participate. The latter may, where applicable, be the subject of one or more divisional patent applications.

[0019] According to one embodiment of the invention, the mobile device application further includes a control module configured to regulate and secure exchanges between the modules of said system.

[0020] Regulating data exchange ensures the proper functioning of the application, in particular by ensuring that information is transmitted at the right time and that the modules are correctly activated. It also improves the security of exchanges between modules and enhances the system's robustness against external attacks and communication errors.

[0021] According to one embodiment of the invention, the biometric data stored by the management module includes a video of the user.

[0022] The use of video ensures that the person using the application and the person with the user account are indeed the same. The video therefore increases the level of security by using an additional biometric data for user authentication.

[0023] According to one embodiment of the invention, the mobile device application further includes a QR code reading module configured to activate the imaging device(s) of the mobile device and to decode and validate the photographed QR code.

[0024] The use of QR codes allows for faster and more secure operation of the authentication system. QR codes are also easier to use, and their use facilitates the integration of the authentication system with other platforms and services that use the same QR codes.

[0025] In a particularly preferred manner, the QR codes used are temporary and dynamic, which strengthens the security of the authentication system.

[0026] According to one embodiment of the invention, the system further comprises an analysis and verification module installed on the authentication server, said module being configured to compare biometric data with recorded biometric data associated with the user account.

[0027] The use of this type of module enables stronger and more efficient authentication. Indeed, this module allows for a comparison of the user account's biometric data with pre-recorded data in a database, which increases the reliability of the authentication system.

[0028] This module is also configured to verify that the user account has been validated by the third-party server.

[0029] According to one embodiment of the invention, the system further comprises an installation module on a digital interface, said module being configured to exchange instructions with the authentication server so as to be able to request authorizations.

[0030] Advantageously, this installation module can be implemented on any digital interface, so as to allow different uses of the application (computers or payment terminals, for example). This simplifies the authentication process for the user while maintaining a high level of security.

[0031] The invention also relates to a user authentication method comprising at least one step of sending an authorization request by a user or a third party from a digital interface, the method being carried out using an authentication system according to the invention, the method further comprising a step of triggering the acquisition module after the step of sending the authorization request, the activation of said module resulting in the activation of at least one imaging device of the mobile device, the user then being invited to take a facial photograph as well as a short video by following instructions provided by the application.

[0032] This authentication method allows for a double verification of the user's identity, firstly by verifying the validity of the user account through a third-party server, and secondly by comparing the identity of the user holding the account with the identity of the user requesting authorization from the application.

[0033] By "short video," we mean that the video generally lasts less than 30 seconds, preferably less than 10 seconds. The user can adopt different postures to verify their presence in front of the mobile device. This additional verification improves system security and allows third parties to verify the identity of users.

[0034] According to one embodiment of the invention, the method further comprises a step of reading a QR code by the application's reading module, said code being displayed by the digital interface after the step of sending the authorization request to the authentication server.

[0035] The use of QR codes improves security when using the application, in addition to being easy to use and quick to implement. It also provides an additional means of authentication and increases the flexibility of the authentication system.

[0036] According to one embodiment of the invention, the step of sending the authorization request is carried out by the digital interface to the authentication server, said server sending back a QR code to the digital interface configured to be read by the reading module of the application of the mobile device.

[0037] Preferably, the QR code is dynamic and temporary, which improves the security of the method. This type of QR code is indeed more difficult to duplicate.

[0038] Preferably, the method includes a step of opening the application on the mobile device, which results in the activation of the QR code reader module. This additional step may optionally trigger the verification process. of the user's identity.

[0039] According to one embodiment of the invention, reading the QR code results in the sending of information from the application to the authentication server, together with a request to activate the acquisition module, so that the validity of the user account is verified by the authentication server.

[0040] This information transmission allows the authentication server to verify that the user is indeed authorized to make the authorization request. The authentication server also verifies at this stage that the user account has been validated by the third-party server.

[0041] According to one embodiment of the invention, the method includes an additional step of sending the user's photo and video to the authentication server, after the triggering step of the acquisition module.

[0042] According to one embodiment of the invention, the method includes a step of verifying the identity of the user carried out by the authentication server, said server comparing the photograph of the user taken and sent by the application to the photograph recorded in the database(s), and verifying the presence of the user in front of the mobile device by video; so that, when these verifications are positive, the authentication server validates the authorization request.

[0043] This additional step makes it possible to verify the identity of the user by ensuring that the person requesting the authorization is indeed the same as that of the user account used (by comparing the photograph taken by the user with the photograph recorded in the database), and of the presence of said user in front of the mobile device (thanks to the video).

[0044] According to one embodiment of the invention, the method includes a preliminary step of creating and validating the user account in the application, said step comprising the following substeps: a first substep of recording the information provided by the user in order to create the user account, a second substep of taking a facial photograph of the user and their identity document, then recording the photographs obtained, a third substep of sending the information and biometric data to a third-party server configured to verify the validity of the identity card and the information provided by the user, and then a final substep of confirming the validity of the user account.

[0045] This step allows a first verification of the user's identity by the third-party server which ensures the validity of the user account, in particular the information provided by the user (validity of the identity document for example).

[0046] The invention also relates to the use of a user authentication method according to the invention for opening a computer session, the application authorization being a request to open a computer session.

[0047] This use allows for better security of computer sessions without the use of passwords.

[0048] The invention also relates to the use of a user authentication method according to the invention to verify the age of an application user holding a user account in order to access goods or services, said application being configured to provide third parties only with the information of majority or minority of the user.

[0049] This method allows third parties to verify a user's age without having to request personal information.

[0050] The invention also relates to the use of a user authentication method according to the invention to validate bank transactions or to validate payment to a third party.

[0051] This method allows for the validation of banking transactions in a more secure manner by ensuring that the user making the request is indeed authorized to carry out the transaction.

[0052] The invention also relates to the use of a user authentication method according to the invention to enable user access to goods or services, such as to provide access to a ticketing system or to enable the retrieval of a package.

[0053] This method allows verification of the identity of ticket users against the identity of the buyer using the application. This method can also be used to verify that a user is authorized to collect a package.

[0054] Thanks to the invention, a single application can serve various purposes and be used by different companies or third parties to secure access to their data or to verify the identity of their users. This also allows third parties to simplify their authentication systems, using only one system that can grant different authorizations after verifying the users' identity, while maximizing the security of said users' personal data. Brief description of the figures.

[0055] Other advantages and features of the invention will become more apparent from the description of a preferred embodiment which will follow, with reference to the attached drawings, made by way of indicative and non-limiting examples and on which: - [Fig.1] is a diagram representing a user authentication system according to the invention; - [Fig.2] represents the first step in creating and verifying an account user on an application of the authentication system according to the invention; - [Fig.3] represents a method of authenticating a user to open a computer session; - [Fig.4] represents a method of user authentication for verify a user's age; - [Fig.5] represents a method of authenticating a user to authorize a banking transaction. Description of the implementation methods.

[0056] As used here, and unless otherwise indicated, the use of the ordinal adjectives "first," "second," etc., to describe an object simply indicates that different occurrences of similar objects are mentioned and does not imply that the objects thus described must be in any given sequence, whether in time, space, ranking, etc. "X and / or Y" means: X alone or Y alone or X+Y. Generally speaking, it will be appreciated that in the various accompanying drawings, the objects are drawn arbitrarily to facilitate their reading.

[0057] Fig. 1 shows the different constituent elements of a user authentication system according to the invention.

[0058] An authentication system according to the invention is designed to enable multi-level verification of a user's (UR) identity. First, when a user account is created on an application 10, the user's identity is verified to ensure that the account holder has a legal existence (by verifying, in particular, an identity document provided by the user). Then, in order to access a good or service, the identity of the user requesting access is verified again, notably by comparing the user's biometric data to ensure that the account holder is indeed the person requesting authorization. This system is therefore more efficient than previously existing authentication systems.

[0059] This authentication system is managed by an independent administrator of end users and affiliated companies that may use said system to determine the identity of users requesting access to their goods and services. These companies may, for example, provide tickets (to access shows or transportation services, for example), or authorize the purchase of specific goods whose access is restricted to certain groups of people, such as alcohol or medication.

[0060] The authentication system according to the invention comprises at least one application 10 configured to be installed on a user's (UR) mobile device 1, such as a smartphone, for example. Other mobile devices can, however, be used to support the application 10, such as tablets, smartwatches, or smart glasses, for example. Thus, the application 10 can be adapted for to integrate into various devices, depending on the needs of the end user or companies wishing to use it.

[0061] This application 10 allows the creation of at least one user account. This account may include information about the user, such as their surname, first name, and date of birth. Other information may be useful, particularly for verifying the validity of the account or for providing limited access to certain goods or services. This information may also include the user's physical address, email address, occupation, or location history, for example. Biometric data is also requested, such as the user's facial photograph (displayed, in particular, on the user account), as well as a photograph of the user's identity card. Preferably, a video of the user may also be recorded, this video being used, in particular, to verify the user's presence in front of the mobile device.Other user-specific biometric data may also be requested, depending, for example, on business needs or the mobile devices supporting the application. Thus, fingerprint registration, iris or retinal scanning, ear recognition, or voice recognition may also be required. This set of information and biometric data will then be used to create the user account and to verify the information contained within that account.

[0062] This mobile device 1 may therefore include at least one imaging device 11, such as a camera, said device enabling the user to be photographed or possibly to be recorded. Thus, depending on the requirements, the mobile device 1 may also include other imaging devices 11 such as fingerprint sensors or an iris scanner, for example.

[0063] More specifically, the application 10 of the mobile device 1 includes several modules enabling the activation of certain components of said device (such as the imaging devices 11) or enabling the exchange of information between the modules. Only the most important modules are listed below, but other modules, not mentioned, may be added as needed.

[0064] The application 10 of the mobile device 1 includes a data transmission module 10A which transmits, in particular, the user's biometric data (UR). This module 10A can exchange said data between the imaging device(s) 11 and one or more other modules of the authentication system. It can thus receive data enabling the activation of the imaging devices 11, or send the biometric data taken by these same devices to other modules. The general structure of such a module is known to those skilled in the art and will not be described further. in detail.

[0065] The application 10 of the mobile device further comprises a biometric data acquisition module 10B used to acquire and receive said data using the imaging device(s) 11 of said device. Thus, while data transfer is performed by the transmission module 10A, data acquisition is performed by this acquisition module 10B. The general structure of such a module is also known to those skilled in the art and will not be described in further detail.

[0066] The application 10 of the mobile device 1 further includes a management module 10C for information provided by the user, said information including, in particular, their biometric data. This module 10C is intended to store and record the information in at least one secure database. The database is preferably located on an authentication server 5 of the manager (as shown in [Fig. 1]). Alternatively, the database may be located within the application 10 of the mobile device 1. Alternatively, two databases may coexist: one on the application 10 of the mobile device (securing only the information of the user or users using this device) and a database on the authentication server 5 of the manager (securing the data of all users of the application 10).The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0067] The application 10 of the mobile device 1 further includes a transfer module 10D for information transfer from the application 10 to one of the servers (3, 5), and optionally, from said servers to the application. This server may, for example, be the manager's authentication server 5, or a third-party server 3. This module can therefore transfer all or part of the information and biometric data provided by the user; it may also send only part of the information provided, such as account information used to verify its validity, for example (UR ID: user account identity sent to server 5, see Figures 3 to 5). The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0068] The authentication system further includes a 3A user identity verification module installed on a third-party server 3. A "third-party server" is defined as a server managed by a company separate from the application manager 10. This company compares the information and data provided by the user with information provided by governments. It is therefore a Remote Identity Verification Service Provider (RPVID), which verifies the validity of the user's identity document using their photograph (if it is still valid and if it actually exists). Once this verification is completed, the A user account is validated and can be used to request permissions or to access goods or services. Advantageously, each user account is associated with a unique set of information and biometric data. The general structure of such a module is familiar to those skilled in the art and will not be described in further detail.

[0069] Advantageously, the authentication system application 10 also includes a control module 10E configured to regulate the various modules of said system and to control the exchanges carried out between said modules. This module thus allows application 10 to manage the exchanges. The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0070] Advantageously, the authentication system application 10 further includes a QR code reader module 10F configured to activate one of the imaging devices 11 of the mobile device 1 to photograph, decode, and validate a QR code. This will allow information to be sent from the application 10 to the manager's authentication server 5, including at least part of the user account, so that the manager's authentication server 5 can verify whether this account has been verified and validated by the third-party server 3. Advantageously, the QR code read is a dynamic and temporary QR code with a validity period of less than 1 minute, preferably less than 30 seconds, so as to maximize the security of the authentication system. The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0071] Advantageously, the authentication system further comprises an analysis and verification module 5A installed on the manager's authentication server 5. This module 5A retrieves the biometric information and data sent by the application 10, and more specifically, the information sent by the transfer module 10D of said application, and compares it with the information contained in the secure database(s). In particular, this module will compare the user's facial photographs and may optionally verify the user's presence in front of the mobile device 1 using video. The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0072] Advantageously, the authentication system further comprises a send and receive module installed on the manager's authentication server 5. This module receives authorization requests so that a user (UR) with an account on the application 10 can access goods or services. This module also sends QR codes to validate authorization requests and to initiate the user identity verification procedure. The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0073] Finally, the authentication system may optionally include an installation module 7A configured for installation on a digital interface 7. A "digital interface" is defined as any interface comprising a screen and capable of sending or receiving data, such as a tablet, computer, video game console, or payment terminal, for example. This installation module 7A will enable communication between the digital interface 7 and the manager's authentication server 5. This module can also send authorization requests to said server, and more specifically to the server's sending and receiving module, and receive access authorizations in response to these requests. It will also receive the QR code (preferably dynamic and temporary), thereby validating the activation of the application 10. The general structure of such a module is also known to those skilled in the art.

[0074] Figures 2 to 5 illustrate steps of the authentication method according to the invention and will be described together. The features described in [Fig. 1] will be repeated in Figures 2 to 5. [Fig. 2] more specifically describes a common preliminary step, regardless of the application of the method, concerning the creation of the user account in the mobile device application. Figures 3 to 5 describe the other steps of the authentication method for three different uses: opening a computer session ([Fig. 3]), verifying a user's age ([Fig. 4]), and validating a banking transaction ([Fig. 5]).

[0075] The user authentication method therefore includes a preliminary step of creating and validating the user account 101 in the application 10 of the mobile device 1. This device 1 is preferably a smartphone, although other mobile devices, as mentioned above, can be considered as supports for the application 10. This step includes several sub-steps described below.

[0076] After downloading the application 10 using methods known to a person skilled in the art on the mobile device 1 on which the application is installed, the user (UR) will make a request to create a user account.

[0077] Following this request, a first sub-step 101A of recording the personal information provided by the user is carried out, with the aim of enabling the creation of the user account in the application 10. This personal information may include, for example, the user's surname, first name(s), and date of birth. This information may be recorded by the management module 10C in the secure database(s).

[0078] Next, a second substep takes place, consisting of photographing user 101B and photographing their identity document. These photographs are advantageously Captured by the application's acquisition module 10B, two photographs are obtained: a facial photograph of the user and a photograph of their identity document. The facial photograph will be used during account creation and will also allow the authentication server 5 to compare it later with the photograph of the user requesting access to goods or services. The photograph of the identity document will allow the third-party server 3 to verify its authenticity by comparing it, for example, to government databases. It will also allow the server to verify the validity of the information provided by the user during account creation. As mentioned above, other biometric data, such as fingerprints, may also be requested and / or used to verify the user's identity and their eligibility to create the account.Photographs, and possibly other biometric data of the user, are recorded in the secure database(s) and associated with the user account. This data is recorded and stored using the 10C management module.

[0079] A third sub-step, sending information 101C to the third-party server 3, is then planned. This information includes, in particular, the user's biometric data. This information and data are optionally transferred to the third-party server 3 using the transfer module 10D of application 10. The verification module 3A of the third-party server 3 allows the managing company to verify the validity of the account user's identity. The server verifies that the identity document is valid, that it is still valid, and that it matches the user's identity document. The information provided by the user is also verified at the same time.

[0080] Finally, once the user's identity has been verified, a final substep 101D occurs in which the verified user account is validated by the third-party server 3 for a limited period, preferably less than 5 years, and particularly preferably for a period of 3 years. The server 3 thus confirms the validity of the account and sends this validation to the application 10 of the mobile device 1 that made the request. This validation is necessary for the user to be able to use their account to make certain authorization requests or access goods or services, or to access other accounts or websites, for example.

[0081] The authentication method, as shown in Figures 3 to 5, is characterized by exchanges between the application 10 of the mobile device 1, the digital interface 7, and the authentication server 5. Once the preliminary step is completed, no further exchanges are planned with the third-party server 3, except in the case of account validity renewal. The steps below are common, regardless of the chosen use of the authentication method.

[0082] First, a request is made from the digital interface 7, consisting of sending an authorization request 102 to the authentication server 5. This request can be made directly by the user, for example, when they request to open a computer session, request access to a website, or wish to validate a bank transaction, for example. This request can also be made by a third party when the interface is a payment terminal, for example (in a store, among other places), or on another type of interface, such as to retrieve a package.

[0083] The digital interface 7 will therefore send this authorization request in the form of a query to the authentication server 5 of the application manager 10, via the installation module 7A installed on said interface 7. This request is then received by the authentication server 5 and processed by its receiving and sending module 5B. Advantageously, this module then sends a QR code, preferably dynamic and temporary, to the digital interface 7. This QR code, displayed by said interface via its installation module 7A, must then be scanned by the application 10 in order to trigger the user's identity verification. Other methods can also be used to trigger the use of the application, such as sending a barcode, for example, or a temporary code.

[0084] The user will then open application 10 on their mobile device 1, and biometric user authentication will be able to take place. Through the application, the user will use the QR code reader module 10F to photograph and decipher the code presented by the digital interface 7 (corresponding to the reading step, 102). This module 10F is configured to be triggered by the user from within the application.

[0085] Reading the QR code triggers the sending of information from application 10 to the authentication server 5. Some account information is then sent, such as a user identifier (UR ID) associated with the account, and a request to trigger the acquisition module 10B of application 10. This information can be sent by the transfer module 10D of application 10 to the authentication server 5.

[0086] The manager's authentication server 5 will then analyze the user's identifier (UR ID) and verify whether the account with which the user is trying to log in has been validated by the third-party server 3. This verification is performed by the analysis and verification module 5A of said server. If this verification is successful, the server sends authorization to the application 10 to allow the triggering of the acquisition module 10B, as well as the activation of one or more imaging devices 11 of the mobile device 1.

[0087] After receiving this authorization, application 10 triggers module 104 Acquisition unit 10B will activate the imaging device(s) 11 via the transmission module 10A, thus enabling facial photography of the user combined with the recording of a short video. "Short" means a video lasting less than 1 minute, preferably less than 30 seconds. The user will be able to adopt certain positions, such as head movements or other actions, by following precise instructions.

[0088] Once these photographs and videos have been taken, they are sent 105 to the authentication server 5. This sending is carried out by the transfer module 10D of the application 10. Optionally, these photographs and videos can be recorded by the management module 10C of the application 10, in the secure database(s).

[0089] The authentication server 5, which receives the user's biometric data, will then perform two successive checks 106. First, a comparison will be made between the photograph stored in the database(s) and associated with the user account and the photograph taken following the request. Preferably, this check is performed by artificial intelligence (AI), preferably combined with a check by an individual working for the application manager 10. This comparison can be performed by the analysis and verification module 5A of said server. Next, a video check is performed. This ensures the presence of the account user in front of the mobile device 1, and thus eliminates the risk of using a simple photograph to activate the account.This verification can also be performed by the 5A analysis and verification module of said server.

[0090] When this double verification is successful, demonstrating that the user is indeed who they claim to be, the validation of the authorization request is sent by the authentication server 5 to the digital interface 7. This authorization can also be sent by the analysis and verification module 5A of said server. The installation module 7A of the digital interface will then validate the authorization request and allow the user to access the desired goods and / or services.

[0091] More specifically, the authentication method can be used to improve security when requesting access to a computer session. This use is more specifically illustrated in [Fig. 3]. The digital interface can then be a computer, a tablet, or any interface whose use may require improved security to access a system or a server, for example. This method is particularly suitable for limiting access to a limited number of people and for keeping the information contained in the session confidential. Thus, the request made on the digital interface 7 is, in this case, a request to open a session. The validation of the identity of The user's authentication via server 5 will allow this request to succeed and will enable the computer session to open. Therefore, a third party requesting access without the necessary authorization cannot gain access, as they could by retrieving passwords.

[0092] The authentication method can also be used to verify an individual's age, particularly for accessing goods or services prohibited to minors (sale of alcohol or medicines, access to specific websites such as online betting sites, for example). This use is more specifically illustrated in [Fig. 4].

[0093] The advantage of such an application is that only information relating to the user's age can be disclosed to a third party (person or company), without having to provide any personal information. Thus, an authorization request is sent by the user from a digital interface 7 (access to online sites, for example), or requested by a third party (from a payment terminal in a store, for example). The user's biometric data is also verified as previously described. Two scenarios are then possible.

[0094] In the first scenario, the user account displayed on the application 10 and presented to the third party includes a feature that allows for the visual distinction between user accounts of minors and user accounts of adults. This allows a third party to request age verification of the user without having access to this personal information (access to a performance venue, purchase of alcohol, etc.).

[0095] In the second scenario, this would allow the user to access websites without providing any information other than their age. This can also be combined with a control mechanism to restrict access to certain sites or platforms, such as parental monitoring devices. A third-party operator of a sports betting site could, for example, use the application and request age verification from the user. The user would not have to provide any other personal information, and use of the site in question could thus be limited to adults only. This method would allow for genuine age verification while minimizing the transmission of personal information.

[0096] The authentication method can also be used to verify the identity of a UR user before validating a payment or bank transaction. This use is more specifically illustrated in [Fig. 5]. Application 10 would ensure that the user is indeed the account holder and is authorized to carry out the requested transaction. The digital interface could then be a computer, a smartphone, a tablet, or a payment terminal, for example. Other types However, several interfaces can be used to carry out this transaction or payment. The request sent from the interface is an authorization request to perform a payment or banking transaction. As before, this request is sent to the server, which, using application 10, verifies that the user account has been validated by the third-party server 3, and that the account user is indeed the same one requesting the transaction or payment. Once these operations are completed, an authorization is sent by the authentication server 5 to the digital interface 7, and the transaction or payment is authorized.

[0097] Other uses are possible for this authentication system and for the authentication method, but are not shown in these figures. In particular, this system or method can be used by a delivery person to verify the identity of the user receiving a package, or can be used by the user to collect a package without using identification. Additionally, application 10 can be used to verify the identity of a person carrying a ticket, and to verify their identity on public transport, or at the entrance to a show, for example.

[0098] The arrangement of the various elements and / or means and / or steps of the invention, in the embodiments described above, should not be understood as requiring such an arrangement in all implementations. In any event, it will be understood that various modifications may be made to these elements and / or means and / or steps, without departing from the spirit and scope of the invention.

[0099] Furthermore, one or more features described only in one embodiment can be combined with one or more other features described only in another embodiment. Similarly, one or more features described only in one embodiment can be generalized to other embodiments, even if this or these features are described only in combination with other features.

[0100] The use of the verb "comprise", "comprendre" or "include" and its conjugated forms does not exclude the presence of other elements or other steps than those stated in a claim.

Claims

Claims

1. A user authentication system comprising at least one application (10) configured to be installed on a mobile device (1), said application comprising: - a transmission module (10A) configured to exchange data from at least one imaging device (11) of the mobile device (1), - a biometric data acquisition module (10B) configured to acquire and receive said data from the transmission module (10A), - a management module (10C) of information provided by a user (UR) and comprising at least the biometric data, said module being configured to store and record said information in at least one secure database, and - an information transfer module (10D) configured to exchange the information between the application (10) and at least one server (3, 5),characterized in that the biometric data acquired and recorded by the application (10) comprise a facial photograph of the user (UR) and a photograph of his identity document, the information being configured to be confirmed by the at least one server, said server being a third-party server (3), so as to create a user account associated with the information of said user, the secure database being installed in an authentication server (5) separate from the third-party server (3).,

2. User authentication system according to claim 1, characterized in that the application (10) of the mobile device (1) further comprises a control module (10E) configured to regulate and secure the exchanges between the modules of said system.

3. User authentication system according to one of claims 1 or 2, characterized in that the biometric data stored by the management module (10C) comprises a video of the user (UR).

4. User authentication system according to one of claims 1 to 3, characterized in that the application (10) of the mobile device (1) further comprises a module (10F) for reading QR codes configured to activate the imaging device(s) (11) of the mobile device (1) and to decode and validate the photographed QR code.

5. User authentication system according to one of the preceding claims, characterized in that said system further comprises a analysis and verification module (5A) installed on the authentication server (5), said module being configured to compare biometric data with registered biometric data associated with the user account.

6. User authentication system according to one of the preceding claims, characterized in that said system further comprises an installation module (7A) on a digital interface (7), said module being configured to exchange instructions with the authentication server (5) so as to be able to request authorizations.

7. Method for authenticating users comprising at least one step of sending an authorization request (102) by a user (UR) or a third party from a digital interface (7), characterized in that the method is carried out using an authentication system according to one of claims 1 to 6, the method further comprising a step of triggering (104) the acquisition module (10B) after the step of sending the authorization request (102), the activation of said module resulting in the activation of at least one imaging device (11) of the mobile device (1), the user (UR) then being invited to take a facial photograph as well as a short video by following instructions provided by the application (10).

8. Method of authenticating users according to claim 7, characterized in that the method further comprises a step of reading a QR code (103) by the reading module (10F) of the application (10), said code being displayed by the digital interface (7) after the step of sending the authorization request (102) to the authentication server (5).

9. User authentication method according to claim 8, characterized in that the step of sending the authorization request (102) is carried out by the digital interface (7) to the authentication server (5), said server returning a QR code to the digital interface (7) configured to be read by the reading module (10F) of the application (10) of the mobile device (1).

10. User authentication method according to one of claims 8 or 9, characterized in that reading the QR code causes information to be sent from the application (10) to the authentication server (5), together with a request to activate the acquisition module (10B), so that the validity of the user account is verified by the authentication server (5).

11. User authentication method according to one of claims 7 to 10, characterized in that said method comprises an additional step of sending (105) the photo and the video of the user (UR) to the authentication server (5), after the step of triggering (104) the acquisition module (10B).

12. User authentication method according to claim 11, characterized in that said method comprises a step of verification (106) of the identity of the user (UR) carried out by the authentication server (5), said server comparing the photograph of the user (UR) taken and sent by the application (10) to the photograph recorded in the database(s), and verifying the presence of the user (UR) in front of the mobile device (1) by the video; so that, when these verifications are positive, the authentication server (5) validates the authorization request.

13. Method for authenticating users according to one of claims 7 to 12, characterized in that the method comprises a preliminary step of creating and validating the user account (101) in the application (10), said step comprising the following sub-steps: - a first sub-step of recording (101A) the information provided by the user (UR) so as to create the user account, - a second sub-step of taking a facial photograph (101B) of the user (UR) and his identity document, then recording the photographs obtained, - a third sub-step of sending the information (101C) and the biometric data to a third-party server (3) configured to carry out a verification of the validity of the identity card and the information provided by the user, then - a final sub-step of confirming the validity of the user account (101D).

14. Use of a user authentication method according to one of claims 7 to 13 to open a computer session, the authorization request being a request to open a computer session.

15. Use of a user authentication method according to one of claims 7 to 13 to verify the age of a user (UR) of the application (10) holding a user account in order to access goods or services, said application being configured to provide only to third parties that the user's majority or minority information (UR).

16. Use of a user authentication method according to one of claims 7 to 13 to validate banking transactions or to validate payment to a third party.

17. Use of a user authentication method according to one of claims 7 to 13 to enable the user (UR) to access goods or services, such as to provide access to a ticket office or enable the collection of a package.

Images